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1.0 INTRODUCTION 

The Integrated Control and Health Monitoring System (ICHM), provides comprehensive control 
and monitoring capabilities in support of overall Orbital Transfer Vehicle Engine (OTVE) mission 
requirements. The OTVE is considered for space-based missions including Lunar/Mars and orbital 
transfer. Such missions would include requirements for long duration space exposure, multiple, 
zero gravity engine starts, as well as the capability for deep throttling for landings. Reusability 
requirements dictate a service-free life of 20 missions, with 100 starts and a total engine operational 
time of 4 hours. The overall system life (with service) requirement is established as 100 missions, 
with 500 starts and engine operational time of 20 hours. 

The ICHM system includes control and condition monitoring electronics, sensing elements, 
software/algorithms and effectors. Effectors are those components of the ICHM which are 
commanded by the controller electronics to operate the OTV engine. These include valve actuators, 
nozzle extension and gimballing actuators and igniters. An artists rendering of the 7.5Klb thrust 
OTVE is shown in Figure 1. 

The ICHM system was conceived around the 20Klb thrust baseline OTV engine. This thrust level 
was selected because Rocketdyne had available power balance model data at off-design conditions 
of; 5 % thrust, representative of 20:1 throttling (at mixture ratio 6:1), and full thrust at a mixture 
ratio of 5: 1. Power balance model data at the on-design condition of 20Klb thrust at a mixture ratio 
of 6:1 was also used. The overall ICHM definition was not impacted by the use of the 20Klb 
thrust baseline, and only a minor effector change (igniter style) would be considered to adapt the 
ICHM results to the 7.5Klb version of the OTVE. The alternate igniter was considered in the 
identification of ICHM elements, and the related cost estimate. The schematic diagram of this 
OTVE configuration is shown in Figure 2. 

Task E6, "Technical Readiness and Development Costs", entailed the definition of the ICHM 
system for the OTV engine. The minimal ICHM system was derived from a flowdown of engine 
requirements into system functions which, evaluated, and translated into a minimal set of ICHM 
elements (sensors, actuators, electronics, and software) to meet requirements with maximal 
technology readiness. A baseline design for each of these elements was described in enough detail 
to estimate the technology readiness and development costs of the minimal system. 
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The details of this selection and estimation process are outlined below, beginning with the 
requirements flowdown process and description of minimal ICHM functions, continuing with a 
definition and description of the elements and sub-elements of the minimal ICHM system, and 
concluding with discussions of these elements' technology readiness and estimated development 
costs. 

1.1 Requirements Flowdown 

Given an input of general, programmatic requirements, the functions of any particular sub-system 
can be derived through a flowdown process. The requirements driving ICHM elements came from 
surveys of NASA Lewis representatives (program monitors) connected with the Earth to Orbit and 
OTV programs, examination of relevant NASA-LeRC briefings and previous reports, discussions 
with Rocketdyne personnel experienced in controls / monitoring and engine systems development , 
review of previous reports on health monitoring systems (OTV-ICHM, HMRSE, ICS, SAFD, 
Mass Data Storage, etc.), and discussions with control and monitoring system component 
vendors. 

The inputs for the flowdown analysis of engine requirements were; A) baseline assumptions, B) 
engine system operability characteristics. 

Baseline assumptions: 

Al. Operation in space environment 

(in particular, the ambient conditions over the range of mission profiles) 

A2. Mission characteristics 

(in particular, the number of engine starts, the time between starts, and the 
duration of each engine engagement) 

A3. Controlled features of external engine structure 

(gimballing of engines by actuation, retractable nozzle, etc.) 

A4. Engine cycle and capabilities 

(specifically, a continuously throttleable to 20:1, hydrogen-oxygen open 
expander cycle, using electromechanical actuation (with pneumatic failsafe 
overrides and having approximately 20 Klbs thrust and Isp of 485 seconds with 
the extendable nozzle) 

A5. Use of redundant/ backup systems 

(desired for sensors, valves, actuators, processor, electronics, harnesses, 
software, etc. where practicable) 
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A6. Minimal ICHM weight 

(flight- weight valves, sensors, electronics, etc.) 

A7. Expandable system design 

(after the minimal system elements are defined, potential growth modes are to be 
specified and prioritized.) 

In particular the features prioritized during customer discussions (see Appendix 
2), with less than a priority value of 10 (on a scale of 1 to 10, where 10 is 
highest) are: 

• Robust engine-out capability (data was uncertain, but treated as "10" and 
thereby included in the minimal ICHM system, this may be a vehicle function) 

• Automated diagnostics to determine ability to complete mission (8) 

• Incorporation of advanced monitoring and/or control techniques as they 
become sufficiently developed and/or available( (6) 

• Real-time diagnostics and prognostics tied to adaptive controls/ knowledge 
based systems (6) 

• Automated pre-mission checkout, includes inspection (4) 

• Extended operation at LOX-rich mixture ratios (3) 

• Automated life prediction (2) 

All of these ICHM-relevant "inputs" can be consolidated and formulated into general and 
fundamental, programmatic, "operability" requirements as follows: 

Engine System Operability Characteristics 

Bl. Performance (incoiporates A4 and A6) 

This represents the need to maintain the specified envelope of thrusts and 
mixture ratios to a specified accuracy. 

B2. Flexibility (incorporates A7) 

This translates into a requirement for an engine controller to actively govern 
engine operations during all mission phases: Automated Start/ Restart in Zero- 
G (Vehicular Pre-Start Readiness Check, etc.). Tank Head Start/ Idle, Steady 
State (throttling control, gimballing, etc.). Normal and Fail-safe Shutdown in 
Zero-G, Post-Mission (automated post-shutdown diagnostics for "engine OK/ 
not OK"), and Between-Mission (possibly with nozzle retraction). 
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B3. Maintainability (incorporates A4 and A7) 

This is the capability for automated engine condition diagnosis, via a health 
monitoring system ensuring the space-based engine has a service-free life. 

B4. Reliabilit y/ Safety (incorporates A5, A6, and A7) 

This requirement is enhanced by health (condition plus safety) monitoring, 
suitable sensor and electronics redundancies (for single and dual engine 
reliability), and appropriate engine control (fail operational / failsafe) 
capabilities. 

B 5 . Reusability (incorporates A 1 , A2, and A3) 

This requires the engine to function properly in a space environment with the 
given life, start and duration characteristics. 

As an initial step, these operability requirements were applied to the most recent baseline engine 
schematic being used in current power balance runs, yielding an updated engine schematic. This 
update was annotated to show parametric values for states spanning the operating range of thrust 
levels and mixture ratios. 

1.2 Derivation of ICHM Functions 

Each requirement was evaluated for its impact upon the ICHM, and a condensed subset of the 
requirements emerged which could be mapped to corresponding minimum functions for the ICHM 
to perform. 

Condensed Requirement Set: (Quantification based upon NASA-LeRC CTP-ICHM NASA- 
Con tractor Videoconference Briefing, 1990) 

• Nominal Engine Operation Control 

• Start and Cutoff Control in a Zero-G Environment 

• Throttling Capability - 10:1 

• Performance Control within +1% for Thrust and Mixture Ratio (MR), based on the 

expected mission profile and current capabilities 

• Single Engine Reliability - fail op/fail safe (0.9975) 

• Dual Engine Reliability - fail op/fail safe ( 0.99958) 

• Service Free Life - 100 starts, 4 hours of operation 
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• Space Based Operations - no EVA 

• Robust Engine Out Capability. 

Each of the OTVE system requirements listed above were evaluated by control system and engine 
system engineers in order to determine the minimum ICHM functions needed to meet each 
requirement. The requirements were mapped to the corresponding minimum functions which the 
ICHM must perform. The results of this evaluation are shown in Figure 3. The dots represent 
which OTVE system requirements are fulfilled by the function. The resulting ICHM minimum 
functions were grouped by engine operation phase. In addition. Figure 3 shows the Safety 
Monitoring Functions which are active during all engine phases and the Engine Diagnostics 
Functions, which are active between missions. Figure 4 depicts element definition from 
requirements. 
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2.0 ICHM ELEMENT DESCRIPTIONS AND LISTS 

In this section, the element selections and associated rationales are presented along with summary 
lists and descriptions of the sensor, actuator, electronic hardware and software elements and sub- 
elements. In selecting many of the system sub-elements, several valid alternative technical 
approaches, representing different levels of technology readiness and desirable 
performance/physical characteristics, were considered. Where applicable, these alternatives are 
discussed as well as the assumptions and criteria underlying the baseline element selections. 

The ICHM system elements can be categorized into four distinct areas, see Figure 5: 

I. Sensors 

II. Effectors (valves, actuators, igniters) 

III. Electronics (controller, data storage, harnesses) 

IV. Algorithms and software (control algorithms, health monitoring software) 

2.1 Sensors 

After the functions were determined, a list of sensors needed to perform the functions was 
generated. The measurements were correlated to the function(s) they serve, as shown in Figure 6. 

Experienced engine systems personnel participated in the effort to minimize the number of 
recommended measurements. The eliminated measurements, the rationale for elimination and a 
brief explanation is given in Table 1. Figure 6 does not include the eliminated sensors. 

There are seven basic types of measurements used in the minimum ICHM system: 

1 . Static pressure 

2 . Static temperature 

3 . Flow 

4. Speed 

5. Displacement (Continuous) 

6. Position (On/Off) 

7 . Acceleration 

The operating ranges for each sensor type in the measurements matrix were obtained through 
engine balance data. This data was examined for three "operating points", shown in Table 2. 
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Measurement 
Location and Type 

Rationale 

Explanation for Elimination 
of Measurement 

Hydrostatic Bearing Inlet 
Pressure (8) 

Redundant 

Would duplicate information given by pump 
discharge pressure 

Fuel Injector Pressure 

Ineffective 

This AP information would not provide 
conclusive condition assessment of the 
injector, due to the cancelling effects of 
erosion and corrosion 

Combustion chamber inlet 
(after GOV) Pressure 

Redundant 

Would duplicate information easily 
calculated from the LOX main turbine outlet 
pressure and the GOV resistance 

Oxidizer CC Injection 
Pressure 

Redundant 

Would duplicate information easily 
calculated from the LOX boost turbine 
outlet pressure and the MOV resistance 

Main LOX Pump Discharge 
Pressure 

Redundant 

Would duplicate information given by main 
LOX turbine inlet pressure 

Boost LOX Turbine Inlet 
Pressure 

Redundant 

Would duplicate information given by main 
LOX pump discharge pressure 

Main LOX Turbine Inlet 
Pressure 

Redundant 

Would duplicate information given by main 
fuel turbine discharge pressure 

Boost LOX Pump 
Discharge Pressure 

Redundant 

Would duplicate information given by LOX 
tank pressure, which is the more useful 

Main LOX Turbine Seal 
Drain Pressure 

Redundant 

Would duplicate information given by the 
seal inlet and purge pressures, due to the 
relative incompressibility of LOX 

FTBV Skin Temperature 

Unnecessary 

Since this valve never needs to be fully 
closed, sealing is not an issue 

TSV Skin Temperature 

Unnecessary 

Specific knowledge regarding leakage in 
this valve is unnecessary; general 
information is contained in the pump 
discharge pressures 

Fuel Valve Skin 
Temperature 

Unnecessary 

Specific knowledge regarding leakage in 
this valve is unnecessary, since 
characterization will be sought during 
development; sufficient information is 
contained in the MFV skin temperature 

Main Fuel Turbine 
Temperature 

Redundant 

Would duplicate information given by the 
nozzle coolant exit temperature 

Main Oxidizer Turbine 
Temperature 

Unnecessary 

Would provide (unnecessary) information 
regarding pump efficiency only; 
unjustifiable in view of harsh environment 

Boost Fuel Turbine 
Temperature 

Unnecessary 

Information unnecessary and of limited 
value 

Main Fuel Turbine Flow 

Unnecessary 

Characterization of injector during design 
and development will ensure flow stability 

Powerhead Acceleration 

Unnecessary 

An optional feature 


Table 1. Measurement List Reduction Rationale 
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Design Point 

Thrust Level 

Mixture Ratio 

On-design engine 

100%, 20K 

6:1 

Off design (1) 

100%, 20K 

5:1 

Off design (2) 

5%, 1 K 

6:1 


TABLE 2, ENGINE BALANCE OPERATING POINTS 
These engine balances, shown in Figures 7, 8 and 9, show the flow, pressure and temperature at 
various engine locations. All of this data, taken together, span the range of operating conditions 
currently under consideration for the OTVE engine and represents the range of conditions that will 
be seen by these sensor types. Sensor selections, shown with accompanying rationale in Table 3, 
were driven by operating condition ranges and needed measurements. 



Static Pressure: 

Silicon on Sapphire 
Pressure Sensor 

History of long term stability (0.01 %/year). Withstands 
continuous exposure to temperatures of approximately 
750°F. 

Static Temperature: 

RTD Temperature 
Sensor 

Proven technology, used on the SSME with a high degree 
of accuracy and stability. 

Flow: 

Turbine Sensor 

Proven technology, used for SSME fuel with a high 
degree of accuracy. 

Speed: 

Variable Reluctance 

Proven technology, used on the SSME. 

Continuous 

Displacement: 

Resolver 

Selected for degree of accuracy needed for deep 
throttling. Use of this sensor will require some testing in 
the development of the system. 

On/ Off Position: 
Eddy Current 

Compact size, used to detect position for fully open or 
closed valve. Proven in similar applications on the SSME 
Technology Test Bed program. 

Acceleration 
Piezo Electric 

Proven technology, used on the SSME. 


TABLE 3, SENSOR SELECTIONS 
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Table 4 shows the selected sensors, the operating ranges, and the several optional sensors. The 
locations of the sensors on the engine are shown in Figure 10. 

2.2 Effectors 

The basis for the effector element selection compares available or emerging designs and the 
requirements of a particular application. Rocketdyne's ongoing development efforts are included 
in the valve and actuator technologies. A particular goal is a reliable, accurate, easily maintainable 
electric actuated propellant valve capable of deep throttling. Commencing with the Advanced 
Space Engine (ASE), an IR&D task was started in 1982 to evaluate and develop electric actuated 
main propellant valves for orbital transfer vehicles (OTV). This work resulted in design and 
characterization of a prototype main oxidizer valve for the 15K thrust RS-44 expander cycle 
engine. An advanced propellant valve based on the prototype main oxidizer valve design is 
recommended for the OTV engine. 

It is assumed that the following elements are supplied by the vehicle contractor: 

I . Propellant tank pressure regulation components (regulator/ relief valves) 

Fuel Tank Pressurization System using autogenous gas from engine 
Oxidizer Tank Pressurization System- using autogenous gas from engine 

II. Inlet Propellant Valves 
Fuel Inlet Valve 
Oxidizer Inlet Valve 

(The propellant tank isolation check valves are considered as part of the engine system as they are 
contained within the engine to tank pressurization lines. In order to provide a more complete 
design description, system requirements will need to be established for these check valves as well 
as the nozzle extender and thrust vector actuators). 

The ICHM has the following propellant valves and components for engine control (component 
types and positions are identified in Table 5): 

1 . Main fuel valve (MFV) 

2 . Main oxidizer valve (MOV) 
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3 . Turbine bypass valve (TBV) 

4 . Oxidizer turbine bypass valve (OTBV) 

5. Turbine shutoff valve (TSV) 

6. Gaseous oxidizer valve (GOV) 

7 . Oxidizer igniter valve (OIV) 

8 . Fuel igniter valve (FI V) 

9 . Oxidizer tank check valve (OTCV) 

1 0. Fuel tank check valve (FTCV) 

1 1 . Pneumatic fail-safe system (PFS) 

1 2 . Nozzle extender actuator (NEA ) 

1 3 . Thrust vector actuator (TV A) 

14. Augmented spark igniter (ASI) 
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NO. 

FUNCTION 

TYPE 

FLUID 

ENGINE 

MODE 

VALVE 

POSITION 

1 

Main Fuel Valve 
(MFV) 

Venturi Ball Valve 
Electric Actuator 
On-Off Control 

LH2 

MS 

PI 

THI 

S 

OPEN 

OPEN 

OPEN 

OPEN 

2 

Main Oxidizer Valve 
(MOV) 

Sector Ball Valve 
Electric Actuator 
Modulating Control 

LOX 

MS 

PI 

THI 

S 

THROTTLED 

THROTTLED 

CLOSED 

CLOSED 

3 

Turbine Bypass 
Valve (TBV) 

Sector Ball Valve 
Electric Actuator 
Modulating Control 

GH2 

MS 

PI 

THI 

S 

THROTTLED 

OPEN 

OPEN 

OPEN 

4 

Oxidizer Turbine 
Bypass Valve 
(OTBV) 

Sector Ball Valve 
Electric Actuator 
Modulating Control 

GH2 

MS 

PI 

THI 

S 

THROTTLED 

THROTTLED 

THROTTLED 

OPEN 

5 

Turbine Shutoff 
Valve (TSV) 

Venturi Ball Valve 
Electric Actuator 
On-Off Control 

GH2 

MS 

PI 

THI 

S 

OPEN 

OPEN 

CLOSED 

CLOSED 

6 

Gaseous Oxidizer 
Valve (GOV) 

Poppet Valve 
Solenoid-operated 
On-Off Control 

GOX 

MS 

PI 

THI 

S 

CLOSED 

CLOSED 

OPEN 

CLOSED 

7 

Oxidizer Igniter 
Valve (OIV) 

Poppet Valve 
Solenoid-operated 
On-Off Control 

GOX 

MS 

PI 

THI 

S 

OPEN 

OPEN 

OPEN 

8 

Fuel Igniter Valve 
(FIV) 

Poppet Valve 
Solenoid-operated 
On-Off Control 

GH2 

MS 

PI 

THI 

S 

OPEN 

OPEN 

OPEN 

OPEN 

9 

Oxid. Tank Check 
Valve (OTCV) 

Check Valve 

GOX 

llUPIli 


10 

Fuel Tank Check 
Valve (FTCV) 

Check Valve 

GH2 



11 

Pneumatic Failsafe 
System (PFS) 

Solenoid-operated 

Bill 

iiiial 

NHMi ' 

12 

Nozzle Extender 
Actuator (NEA) 

Electric Actuator 
On-Off Control 

§||Jj| 

— 

IBB! 

13 

Thrust Vector 
Actuator (TV A) 

Electric Actuator 
6-15 deg Modulating Con- 
trol in both X- and Y- axes 

| 

Wfc 

1 

14 

Augmented Spark 
Igniter (ASI) 

Spark Igniter 

m 

Bill 

'Jlllplff 

ENGINE MODE 1 
MS = Main Stage 

JEGEND: (20K Thrust) THI = Tank Head Idle S=Start 

PI = Pumped-ldle 


Table 5. Effectors 
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A brief discussion of the control valve functions during engine start, tank head idle, pumped idle, 
and main stage operation is presented on the following pages. 

Main Fuel Valve (MFV) 

The MFV is an electric actuated on/off cryogenic valve which opens fully to permit fuel flow at 
engine start and remains open throughout all of the engine operational modes. Minimum pressure 
drop in the fuel circuit is required along with capability for tight shutoff. 

Main Oxidizer Valve (MOV) 

The MOV is a fully modulating cryogenic valve responsible for mixture ratio control. During start 
and tank head idle the valve is fully closed forcing LOX through the GOX heat exchanger. At 
pumped idle the valve is ramped, open loop, to an intermediate position providing limited oxidizer 
flow to the engine. At main stage the valve opens more fully and is under closed loop control on 
mixture ratio. This valve must be capable of tight shutoff. 

Turbine Bypass Valve (TBV1 

The TBV is a modulating valve with no tight shutoff requirement which controls engine thrust 
by throttling fuel flow to the turbines. During start and tank head idle this valve is full open 
allowing fuel from the nozzle to bypass the turbines and flow through the GOX heat 
exchanger to provide gaseous oxygen flow to the igniter and combustor. During pumped idle 
the TBV is maintained full open as the turbine shutoff valve (TSV) is opened which results in 
some fuel flow to the turbines. At mainstage the TBV is in its most throttled position 
modulating under closed loop control on thrust 

Oxidizer Turbine Bypass Valve (OTBV) 

The OTBV is similar to the TBV in that it is also a modulating valve with no tight shutoff 
requirements. Its primary purpose is to balance the oxidizer and fuel pump turbines. During start 
and tank head idle the valve is at full open or an intermediate position but does not control any flow 
as the TSV is closed. During pumped idle (with the TSV open) the OTBV is ramped, open loop, 
to an intermediate position which forces some fuel through the oxidizer main pump turbine. At 
mainstage the OTBV is in its most throttled position under closed loop control on pump turbine 
balance. 
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Turbine Shutoff Valve (TSV) 

The TSV is an on/off valve which is closed during start and tank head idle mode with minimal 
turbine gas flow such that the turbines do not spin. The valve is ramped to full open during 
pumped idle and remains open at main stage. Like the MFV, a minimum pressure drop is 
required. 

Gaseous Oxidizer Valve fGOVl 

The GOV is a two way (on/off) direct or pilot operated solenoid valve, open only during tank head 
idle operation providing gaseous oxygen flow to the combustor. During the transition to pumped 
idle the valve is closed. 

Igniter Valves (OIV. FI VI 

The igniter valves are two way (on/off) solenoid valves which provide gaseous oxidizer and fuel to 
the igniter throughout all engine operational modes. 

Propellant Tank Check Valves fFTCV. OTCV1 

The FTCV and OTCV prevent backflow from the cryogenic propellant tanks to the turbines when 
the engine is inactive. The check valves also serve to isolate propellant between each engine. 

Nozzle Extender Actuator (NEA1 

The NEA is a linear electrically actuated system which extends a radiation cooled nozzle. 
Following engine shutdown, the NEA retracts the nozzle back to the stowed position when 
required. 

Thrust Vector Actuator (TVA) 

The TVA consists of two linear electric actuators which provide gimballing control. The TVA will 
provide 6 to 15 degrees modulating control in both x and y axes. 

Augmented Spark Igniter (ASP 

Two Augmented Spark Igniters (ASI) will be used to ensure reliability. The components for the 
igniter include: 

1 . Electronic ignition exciter (2) 

2. High-voltage cable (2) 

3 . Spark igniter plug (2) 

4. Ignitor injector/precombustor 
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All of the components are separable. Spark igniters and the igniter injector are installed using 
threaded joints. Electronic components are dual redundant. Failure of any single electrical 
component will not cause ignition failure. Ignition is accomplished by activating the spark system 
and introducing propellants into the igniter. These propellants are injected in a pattern that provides 
cold fuel surrounding the oxidizer. This pattern ensures cooling so an additional supplemental 
cooling system is not required. The ignition system is reusable and restarts without component 
replacement or servicing. 

2.2.1. Effector Design Description 

Three types of propellant control valves are proposed for the OTV engine: 1) sector ball valve, 2) 
venturi ball valve and 3) solenoid operated poppet valves. The sector ball valve will be used for 
low torque applications. For low pressure drop the venturi ball valve will be used. Low flow 
ignition and control applications will employ either direct or pilot operated solenoid valves. 

Electric Ac tuated Cryogenic Propellant Control Valves . 

The electric actuated MOV consists of a sector ball gate to throttle flow that is supported on integral 
shafts by a pair of ball bearings, and positioned by an electromechanical actuator with closed loop 
position feedback from a resolver off the ball shaft. The gate configuration is basically one-half of 
a spherical shell. Sealing is provided by shaft seals and ball seals of DuPont Vespel. Modular 
construction permits easy disassembly of the actuator, valve module and seat package from a single 
valve housing flange. The valve housing can therefore remain attached to the propellant ducts. 

A key feature of the Rocketdyne sector valve is the continuous-contact seat seal design. This 
design is basically similar to the very successful SSME shaft seal subsequently used in the ASE 
and RS-44 integrated component evaluator (ICE) propellant valves. These designs maintain micro 
inch level of leakage gap under extremely high bearing loads which is achieved through the unique 
characteristics of DuPont Vespel SP-21 1 , a combination of polyimide, graphite, and Teflon. The 
material has demonstrated compatibility with LOX and LH2 over the full range of expected 
operating conditions. Leakage can be held to less than 10 scim helium, however, higher limits are 
recommended because system allowances are considerably greater and lower costs result. All 
external valve leakage can be collected by use of redundant shaft seals and two static flange seals 
with the intermediate cavities connected to a single housing port for safe venting overboard. This 
feature permits potential "growth" instrumentation for health monitoring of each valve for external 
leakage before, during and after each engine firing. 
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The seat seal package is a modular assembly comprised of a retainer, snap ring, wave springs, 
loader, and seal. The wave springs provide load to seal at low pressure and also overcome friction 
forces at cryogenic temperature. All seal design parameters are anchored by test data and defined 
by computer analysis which permits definition of an optimal design. Equations for seal reaction 
forces consider thermal contraction, radial seal clearance or interference, pressure differential, 
loader force, friction and seal material elastic parameters. 

Coupling the valve shaft to the actuator is a metal bellows which provides for thermally induced 
axial motion, is radially stiff, and has no free play. The valve and actuation system is designed to 
maintain backlash and elastic windup to less than 0.3 degree under maximum load. Response will 
be less than 1.0 second full travel under maximum load with capability of less than 0.2 second at 
reduced or aiding loads to permit fast shutdown as required. 

The MFV requires a larger flow area than the MOV due to lower pressure drop requirements. A 
full ball with venturi inlet and outlet flow sections to reduce delta P will be used with the MFV to 
permit a common valve size with the MOV. Thus the MFV will be identical with the MOV except 
for the noted variations in closure and flow geometry to provide low pressure drop with nearly 
common cryogenic propellant valves. 

Turbine Gas Valve Design 

Turbine gas valves (OTBV, TBV, TSV) are patterned after the MOV but with several variations. 
Valve body, gate and bearing materials must withstand temperatures to 950 degrees F and 
pressures to 7674 psia. Although stringent leakage requirements are not required for the seat seal, 
the shaft seal may see high temperature. Consequently, two paths will be followed to address 
function of the shaft seal: 

1) A carbon/graphite seal will be designed for operation at 950 degrees F, but with the 
actuator both insulated and thermally isolated from the valve. 

2) As backup, polyimide shaft seals will be thermally isolated from the valve with the 
actuator to prevent seal temperatures exceeding 350 degrees F. 

The TSV will have the same full ball venturi flow geometry as the MFV to provide low pressure 
drop. Additionally the TSV has a requirement to shut-off sufficient turbine gas flow such that the 
turbines do not spin during tank head idle. Two alternative seat seal designs considered are: 1) an 
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all metal dry film lubricated seat seal as used on the RS-44 TBV and OTBV, and 2) a 
carbon/graphite design mated with a molybdenum seat tube insert which provides a very close 
match in thermal expansion with the carbon seal material. Fortunately, this seal needs to operate 
only at relatively low pressure differential with liberal leakage allowance. Primary parameters to be 
considered in design are therefore long life and reliability. 

Solenoid Operated Valves 

The GOV, IGOV and IGFV are two-way solenoid operated valves providing on/off control of 
GOX and GH2 propellants at low flow rates. Key features are rugged simplicity providing high 
reliability and low cost. Dual coils can be provided for electrical redundancy as required. 

Check Valves 

Propellant tank isolation between the OTV engines will be provided by the OTCV and FTCV. 
These are poppet-type check valves which can be used in series for redundancy as required. 

Pneumatic Fail-safe System Components 

The pneumatic fail-safe system consists of a regulated pneumatic supply, pneumatic control 
assembly (PCA) and fail-safe actuators mounted to the necessary engine control valves needed to 
effect a safe engine shutdown. All control components will have redundant electrical actuator 
systems such that upon any electrical failure the secondary system can provide fail-operation of the 
OTV engine. Upon failure of the secondary system, the actuator will lock in position until the 
pneumatic fail-safe system is energized from the PCA to provide a sequenced valve deactuation that 
will safely shutdown the engine. 

Nozzle Extender and Thrust Vector Actuators 

These components are electromechanically actuated with dual electrical redundancy. 

2.3 Electronics 

The intent of the control system block diagram is to indicate the features which will satisfy the 
stated requirements and perform the minimum functions necessary for successful OTV operation. 
A dual channel architecture is the baseline, with additional redundancy possible, each with its own 
power supply and heater. The architecture will be modular to accommodate additional capability, 
new technologies, or increased redundancy. 
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Single channel controller functions are broken down into three main areas; input processing, 
control processing, and output processing. Input processing contains the interface between the 
sensors ( temperature, pressure, speed, flow, and acceleration) and the controller. Control 
processing contains the interface to the vehicle ( telemetry information and vehicle commands) , 
performs high level control like thrust / mixture ratio control, and any real-time algorithms. 
Finally, the output processing section contains the effector control drivers (solenoids, igniters, and 
closed loop actuators) and receives all valve positions (RVDT and LVDT). All functional areas 
connect to the data interconnect busses which will be standardized types of parallel busses. 
Functional areas may be made up of several circuit cards, each with a separate interface to the 
parallel data busses. 

Channels are complete with their own separate power supply and heater. Power supplies are 
responsible for all power for their respective channel including sensors and valves and will be 
electrically isolated. The heater is necessary to keep electronics from becoming cold enough to , 
among other things, crack solder joints or deteriorate capacitors. If enough electrical activity is 
present in the vehicle between missions, for example by telemetry, heaters may be eliminated. 

Each of the three main functional areas will be linked to the other channel(s) via the data busses. 
The type and extent of redundancy management has yet to be determined. However, an up front 
goal will be to minimize software complexity by simplifying the channel interaction. Technological 
advances in VLSI should improve channel reliability. 

A preliminary schematic of the controller architecture is shown in Figure 11. 

Input Electronics 

The function of the Input Electronic module is to condition and convert engine sensor data to digital 
data for processing. Data to be measured includes temperatures, pressures, speeds, flows and 
acceleration. 

For cryogenic temperature measurements, RTD's are best suited because the signal output levels 
are higher. A constant current supply will provide an accurate reference with the voltage drop 
across the RTD being directly proportional to resistance. For hot gas temperature measurement, 
thermocouples may be used because of their inherent structural ruggedness. Use of thermocouples 
will require additional circuitry to amplify the low level signals and provide ice point referencing. 
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Pressure sensors require an accurate voltage reference from the Input Electronics and provide a 
differential bridge output. The output of the bridge is filtered and amplified and converted to a digital 
value for scaling in the Input Electronics Micro-controller (IEMC). 

Speed and flow processing are handled in a similar manner. An EMF generated by a rotating 
magnetic field is picked up in a coil and the period of the generated waveform is measured using a 
time measurement counter. A zero crossing detector is employed to determine beginning and 
ending of a measurement period. 

Signal Conditioning will consist of passive input filters on all inputs to reject EMI followed by a 
low pass filter for anti-aliasing and buffering where required. Temperature and pressure data 
together with any other analog data will be multiplexed into a 12 bit A-D converter for conversion 
to digital data. 

The IEMC will perform reasonableness test based on engine model data to determine the condition 
of the engine sensors. Scenarios considered to accommodate unreasonable sensors include; 
excluding that sensor from calculations and using the channel B sensor, or possibly using a 
"weighted sum of system health parameters" model, with weightings adjusted to compensate for 
lack of the unreasonable sensor value. The IEMC will also control self test of the Input Electronics 
to ensure the validity of all data reported to the Controller Bus. It will perform the necessary 
scaling of data and report it on the Controller Bus for all users, such as the Engine Controller or the 
Condition Monitor. 

The IEMC will consist of a 32-bit processor with a fixed program memory (PROM) and static 
memory (RAM) for working memory. Because its operation is critical to the input electronics, the 
IEMC will be a self checking controller and the memory will be an error detection and correction 
memory. It will provide the protocol to communicate to the Controller Bus as well as do 
processing. The input processing block diagram is shown in Figure 12. 

2.3.2 Con troller Processor 

The function of the Control Processor (CP) is to receive vehicle commands such as engine 
checkout, start, throttle or cutoff and control the engine operation. Mixture ratio and throttle 
control will be done in the CP using data from the input electronics and the output electronics and 
sending valve position commands to the output electronics. Engine data will be stored in a bulk 
memory during engine operation for processing after cutoff. Fifty two measurements have been 
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identified and fifty measurements per second will require about 1.5 Mbytes of memory for 10 
minutes of engine operation. Data which requires a higher update rate, such as tracking filters or 
other special processing must be supported by special purpose processors to pre-process data for 
storage in the bulk memory, input and output electronics data received in the CP has been fully 
qualified and can be used without further reasonableness testing. 

The CP will consist of a 32-bit processor with a fixed program memory (PROM) and static 
memory (RAM) for working memory. Because its operation is critical to engine control, the CP 
will be a self checking processor and the memory will be an error detection and correction 
memory. 

The Controller Architecture will have two or more independent bus interfaces depending on the 
necessary redundancy to achieve the required reliability. Each input electronics and output 
electronics will be capable of communicating on each bus to provide the necessary cross strapping 
of engine data. The control processing block diagram is shown in Figure 13. 

2.3.3 Engine Vehicle Interfa ce and Power Supply 

The elements which will be used to interface with the vehicle will include digital telemetry bus 
electronics, digital vehicle bus electronics, a telemetry bus, and a vehicle command bus. These 
elements are also shown in Figure 13. 

The function of the power supply is to convert the 28 volt vehicle power to the necessary digital 
and analog voltages to power the controller circuits. The power supply must also contain fault 
monitor circuits to detect loss of input power and power supply failures. 

2.3.4 Output Electronics 

The function of the Output Electronics (OE) (Figure 14) unit is to receive valve position commands 
from the Control Processor and generate the necessary voltage and current drive required to operate 
the engine valves and solenoids. The OE will also monitor the valves for proper response by 
measurement of valve current, voltage and position. The OE will provide the command and 
monitoring for the ignitor modules. All solenoids and solenoid drivers will be designed to operate 
from 24 to 32 volts DC to make use of standard vehicle power and the solenoid drive current 
should be isolated from the controller power and ground. 
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Valve drivers must drive both on-off and proportional valves with high efficiency if the design 
goals of the control system are to be met. New valve drivers being developed for the automotive 
industry offer efficient operation and have built in self test features. Electromagnetic actuator 
drivers present a challenge both in circuit design and packaging. High efficiency amplifier design 
must be developed for increased efficiency. 

Measurement of valve position in the past has employed RVDT'S and LVDT’S, which are not 
capable of better accuracy than 1% to 2%. More accuracy is required and other techniques such as 
radiometric RVDT'S, optical position encoders, and resolvers can provide 0.1% accuracy. 
Monolithic integrated circuits are available for circuit implementation of all these techniques. 

Spark ignitor control and monitoring may be provided in the output electronics. To detect 
degradation in the spark ignitor, it will be necessary to design a monitor circuit which measures 
the spark energy and compares it to nominal values. A review of SSME experience will be 
conducted to determine the necessity of this check. 

The OE functions will be controlled by an output electronics micro-controller (OEMC) with a 
stored memory program. Data such as valve position commands will be received in the OEMC via 
the Controller Bus. The OEMC will convert the command to a form required by the valve driver 
and verify that the valve responded. Monitoring of the valve drivers will also provide information 
about faulty drivers or open coils and this will be put on the bus for the health monitoring function. 
The OEMC will consist of a 32-bit processor with a fixed program memory (PROM) and static 
memory (RAM) for working memory. Because its operation is critical to the output electronics self 
test function the OEMC will be a self checking processor and the memory will be an error detection 
and correction memory. 

2.4 Algorithms and Software 

The ICHM software can be broken down into three categories: Engine control (includes both 
performance regulation and implementation of health monitoring decisions), Health Monitoring 
(Safety monitoring,Condition Monitoring, including Maintenance assessments), and General/ 
Executive functions (those which support operation of the ICHM system rather than implementing 
specific OTVE operating requirements and includes sensor calibration, measurement validation, 
and communications functions). Table 6 describe the software sub-elements organized into these 
categories. 
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ENGINE CONTROL 

Pre-Flight Operations 
Start Sequencing 
Tank Head Idle Operation 
Pumped Idle Operation 
Mainstage Operation 
Shutdown Sequencing 
Post-Flight Operations 


GENERAL/EXECUTIVE 

Processing Cycle Control 
Exception And Interrupt Control 
Computer Initialization 
Redundancy Management 
Command & Data Interface Control 
Input/Output Control 


SAFETY FEATURES 

Redline Monitoring 

Engine Fault Emergency Shutdown 

Control Failure Emergency Shutdown 

CONDITION MONITORING 

System Condition Monitoring 

Pre-Flight Checkout 
Post-Flight Checkout 
In-Flight Performance Monitoring 
Data Storage 

Component Condition Monitoring 

High-Speed Turbopump Monitoring 
Data Storage 


PROCESSING AND DIAGNOSIS 

Health Monitoring Data Processing 
Data Presentation 
Performance Data Processing 


Table 6. ICHM Software Element Breakdown 
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Preliminary software functions for the minimal ICHM system are defined based on the ICHM 
functional requirements previously identified. In most cases, specific requirements cannot be 
established until the OTVE design is further defined. Therefore, the list of software functions is 
intended to be representative of the software expected for a minimal ICHM rather than an all 
inclusive baseline. In general, the development of the ICHM System algorithms and software 
should be straightforward, with low risk in terms of cost and schedule. 

2.4.1 Engine Control 

Engine control includes the code for execution of the operating sequence and closed loop control 
algorithms in controlling the engine through all its modes of nominal operation. 

Engine safety includes the code for monitoring of engine redlines and for executing the appropriate 
emergency engine shutdown depending on whether and engine fault or a computer control failure 
had occurred. 

2.4. 1.1 System Condition Monitoring The system health monitoring code checks the pre- 
flight health and readiness of the engine and ICHM system. It also performs limited in-flight 
monitoring of system health. System health monitoring requirements for the minimum system 
include at least: continuous in-flight and pre-flight checkout; engine system readiness/health 
assessment; limited continuous monitoring of the ICHM system health; and transfer of monitoring 
data to the vehicle for storage and/or telemetry. Pre-flight checkout may be considered as "post- 
flight", in that any pre-flight checkout after the initial mission should recognize problems caused by 
the previous use. 

2.4.2 Cond ition Monitorine 

2.4.2. 1 Component Condition Monitoring The component health monitoring code 
monitors operation of the high-speed turbopumps. In conjunction with signal 
processing/conditioning hardware, it extracts health indication signature information from sensor 
data and prepares it for data transmission. At this time, it appears that the high speed turbopumps 
are the leading candidates for component health monitoring. No other engine system components 
appear to have a significant probability of failure or major degradation during the specified service 
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free life. The minimal system will therefore include the sensors, signal conditioning and 
failure/degradadon software for monitoring the high-speed fuel and oxidizer turbopumps. If future 
analysis or test of other engine components reveal significant wear or other degradation/failure 
mechanism, appropriate sensors, signal processing and monitoring algorithms will be developed. 

2.4. 2.2 Processing and Diagnosis Maintenance decision and performance evaluation code 
operates in general purpose computers to process monitoring data and present it in a meaningful 
form for analysis by logistics and engine performance experts. 

2.4.3 Executive 

Real-time executive code manages the operation of all other software and provides "housekeeping” 
services. It includes processing cycle control, exception/interrupt handling and computer 
initialization. In addition the executive manages the redundancy of all control system elements, 
controls the command and data interface with the vehicle and and controls the sensor input and 
actuator output channels. 
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3.0 ELEMENT TECHNOLOGY READINESS FOR MINIMAL SYSTEM 

ICHM functions and ICHM system elements were defined in previous subtasks. The ICHM 
elements which emerge from the ICHM functions fall into the following categories: 

1 . Sensors 

2. Effectors 

3 . Electronics (harnessing and controller hardware) 

4. Software/ Algorithms 

A. Engine control algorithms (feedback control loops of valve position measurement/ 
control and fine-tuning of performance) 

B. Safety algorithms/ advanced redline control algorithms done in real-time and used 
for control decisions 

C. Condition monitoring (life prediction/ maintenance analysis/ component 
diagnosis) algorithms not necessarily in real-time 

Items B and C, taken together constitute Health Monitoring algorithms. A, B, and C: Integrated 
Control and Health Monitoring algorithms. All elements together make up the ICHM system 

Table 7 presents the technology readiness levels definitions, from 1 to 7, as furnished by NASA in 
the task work statement Technical readiness was determined by review of the technical staff, with 
specific element expertise. Elements were separated into four categories: sensors, electronics, 
effectors, and software/ algorithms. A summary of the element categories, technologies or 
functional types, and element readiness levels is shown in Table 8 on the following pages. 
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Level 7 


Level 6 


Level 5 


Level 4 


Level 3 


Level 2 


Level 1 


Technology Readiness Levels; Definition 


System validation model demonstrated 
in space; system ready for space-based 
applications 


System validation model demonstrated 
in simulated environment; test of an 
equivalent of the final system 
configuration 



Component and/or breadboard 
demonstrated in relevant environment 


Component and/or breadboard 
demonstrated in laboratory 



Analytical and experimental proof-of- 
concept for critical function and/or 
characteristic; conceptual design test 



Technology concept/ application 
formulated; conceptual design drafted 



Basic principles observed and reported 



TABLE 7 
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4.0 ESTIMATE REMAINING DEVELOPMENT COSTS FOR MINIMAL SYSTEM 

Cost estimates were developed based on similar component or system development efforts. A 
summary of the estimating results is presented in Table 9. A brief basis of estimate is stated for 
each category of ICHM elements, followed by general assumptions or detailed estimating 
guidelines used in the respective estimates. These estimates are considered accurate to +/- 20%. 
An important underlying assumption is based on discussions with NASA-LeRC; that is that the 
level 6 validation testing engine/test stand support will be provided by NASA. This means that the 
Rocketdyne level 6 efforts encompass required on-site support to testing, analysis, and actions 
based on results of that testing. No Rocketdyne labor is estimated for running the engine in the test 
stand. 

Controller Electronics Hardware 

The controller and associated electronics were based on the SSME controller, a full authority 
digital rocket engine controller, which is the closest existing similar hardware program available. 
The entire list of non-recurring tasks portion of the basis of estimate index for the SSME Controller 
Block II proposal was examined and complexity factors were applied to extrapolate ICHM 
controller electronics estimates. Additionally a set of design ground rules was established which 
are presented in Appendix 1, and general assumptions were made. The electronics labor cost 
estimate is about $23M, and related hardware is $3M. This portion of the effort is one requiring 
the longest development schedule, 60 months. 

General Assumptions 

1. Utilize a standardized bus such as, VME, MULTIBUS, Future Bus, 1553 

2. Utilize a standardized single board computer with integrated bus interfaces. The design will be 
brought up to a space-rated qualification. 

3. Extensively use hybrids or VLSI to reduce size and weight. 

4. Assume the same close technical and cost control by NASA as done during the development 
efforts on SSME Block I, Block II controllers. 
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Sensors 

Sensors development cost estimates were based several program efforts. These include the 
Peacekeeper Stage IV, the SSME TTBE and Kinetic Energy Weapons programs. For each sensor 
selection considered, the program with the most up to date applicable cost data was used as a cost 
basis. A summary of the sensor cost estimates is presented in Table 10. 

Sensor Estimating Guidelines 

The basis for bringing a sensor to technology readiness level 5 involves qualification. This proves 
the sensor design in a simulated environment. This activity would require 6 manmonths of effort 
per sensor, over a duration of 9 months. 

To get to level 6 certification from level 5 requires proving the design in a test stand green run. 
Going to level 6 assumes engine availability for 17 tests at 300 seconds each. Certification time is 
5000 seconds. To recertify a currently certified sensor to a new engine requires manpower of 510 
hours (30 hours per test for 17 tests). The adaptation of a level 7 sensor to the target application 
requires 20 hours per sensor. 

Effectors 

The valve actuator estimates were based on actual hardware development experience in similar 
technology applications (eg electromechanical or pneumatic driven). The nozzle extension and 
gimbal actuators estimates were based on engineering judgement, experience, and operational 
requirement interpretation. The igniter estimates were based on applications in similar-sized 
injectors from recent and ongoing hardware development programs. The Space Transportation 
Main Engine (STME) gas generator (adapted from the SSME program) is used as the basis for the 
augmented spark ignitor, and the subscale liquid oxygen/hydrocarbon propellant injector is used as 
the basis for the plasma torch ignitor. A summary of the effector cost estimates is presented in 
Table 11. 

Effector Estimating Guidelines 

Valves: The philosophy to this approach is to design the valves with the eventual flight application 
in mind. Granted, a flightweight valve is not required in a Focused Test Bed environment, but 
overall program cost (to get to the ultimate flight article) are significantly reduced by eliminating a 
second design iteration to go from a heavy, large envelope breadboard valve to the flight-sized 
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article. This approach did, however, consider applying an "experimental" hardware method 
(7R drawings. Category VII) to the design process. This facilitates the development process by 
requiring substantially fewer reviews and signatures, and far less processing, for the 
implementation of iterative design changes through the development process. 7R drawings are 
engineering drawings used for experimental hardware. They do not undergo full configuration 
management and control, and do not go through the formal engineering release process like 9R 
(Category II) drawings do. A more detailed explanation of these drawing types is found in 
Appendix II, Engineering Drawings, Categories and Uses. This experimental, 7R drawing 
estimating basis is appropriate and was adopted as a result of discussions with LeRC during the 
course of this program. The sum esumate of valve design and design verification testing (DVT) 
labor for all valves and the pneumatic control assembly is 45,344 hours. 

Actuators: This cost is based on the SSME actuator evolution from conceptual design to 
development test for a deliverable product. In this case an outside vendor designed, developed and 
tested the actuators, and Rocketdyne provided support. The team worked on a man-rated design 
that met the fail-op/fail safe requirements which are found on the ICHM program. Although the 
subject SSME actuator is hydraulic, hydraulic actuator technology at the start of that development 
is comparable with today's commercially existing EMA technology. The estimated cost was $6M 
for the ICHM effort, reflecting the reduced complexity of design (and related design verification 
testing) change implementation realized when going from NASA development to NASA 
experimental hardware production. The $6M is treated as hardware for costing purposes, since it 
is a commodity purchased out-of-house. The estimate of Rocketdyne actuator design and design 
verification testing (DVT) "support to vendor" labor for actuators is 66,000 hours. Both the valve 
and the actuator efforts are estimated to require 48 months of schedule. 

Ignitors: Ignitor costs considered a parallel effort of preparing two styles of ignitors for the target 
ICHM application. This is considered since 2 different thrust levels are being considered for the 
OTVE implementation, and different styles of ignitors are better suited for each respective thrust 
level. A 20Klb configuration would accommodate an augmented spark ignitor (ASI) 
configuration, where the smaller injector faceplate and injector element diameters of the 7.5Klb 
OTVE would require a plasma torch ignitor. For either style ignitor, a three unit basis was used 
for material estimating, two for the main combustion chamber redundant ignitor configuration, and 
one spare. For the ASI, $15,000 each was used for material cost, plus 2000 hours to adapt the 
current level 7 design. For the plasma torch ignitor, material basis was $20,000 each, plus 4000 
hours for adapting the current level 6 article design. The time duration required for either ignitor 
development is 12 months. 
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Software/ Algorithms 

These development cost estimates were based on complexity factors and ICHM adaptation effort 
applied to the SSME controller software. Software functions were defined in terms of software 
lines of code. This was translated to cost using an "hours per line of code" conversion factor on 
the "adapted, complexity-factored" lines of code for the sum of ICHM software functions. 

Software Estimating Guidelines 

This activity started with considering how many hours per software line of code (SLOC), are 
required to adapt similar code to level six, where the existing code is at a specific technology 
readiness level. The assumption used is that the software code should be refined enough for 
"expensive asset" end uses since the Focused Testbed Engine and test stand for ICHM application 
would be of substantial value. Software development methods (degree of quality assurance, 
testing, etc.) for the expensive asset category are those which are currently followed for propulsion 
systems used for launching expensive satellites, in un-manned spacecraft. Other types of end uses 
are non-flight, and manned flight. 

Hours to adapt each S LOC to ICHM level 6 

expensive asset application current level of similar function 

4.0 7 

5.4 6 

5.6 5 

5.8 4 

6.0 3 

6.2 2 

6.4 1 

A complexity factor (typically between 1.0 and 1.4), was developed relative to the SSME 
functions, to quantify the relative degree of complexity in implementing similar ICHM functions. 
The hours/SLOC was multiplied by this complexity factor, along with the number of lines of code 
in a given function. 

Thus: (Hours/SLOC for adapting a function to ICHM to level 6) x (complexity factor) x (number 
of lines in a function) = hours of labor per software function. The results of using this method on 
each function were summed to give the total estimated hours of labor, which is 86396 hours. 
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CONCLUSION 

An ICHM system was conceived for use on a 20Klb thrust baseline OTV engine. The approach to 
this conception was to provide the requisite ICHM functions in a configuration with minimal 
elements and applying current technologies wherever possible. 

This report described how the ICHM functions were derived from flowing down requirements 
from the statement of work and other OTV engine or ICHM documents. The elements of an 
ICHM were identified and listed, and these elements were described in sufficient detail to allow 
estimation of their technology readiness levels. 

The ICHM elements were assessed in terms of technology readiness level, and supporting rationale 
for these assessments was presented. 

The remaining development cost for development of the minimal ICHM system to technology 
readiness level 6 were estimated. The estimates were based on similar program activities and are 
within an accuracy range of plus or minus 20%. The cost estimates cover what is needed to 
prepare an ICHM system for use on a focussed test bed for an expander cycle engine, excluding 
support to the actual test bed firings. 

The system which was described represents a minimal system, with potential for future growth in 
both capability and incorporation of advances. The estimated cost represents a reasonable amount 
of resources which could be applied to allow a demonstration of the ICHM by the year 2000. 
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APPENDIX 1, ELECTRONICS DESIGN GROUND RULES 
Controller Electronics Hardware Design Groundrules 


1. Use hybrids to reduce size of temperature and pressure circuits. 

A. Programmable constant current supplier 

B. Electronic aliasing filters 

2. Use .050" pin to pin spacing - not flown in space yet. 

3. Use ramp clamps to get heat to side rails. 

A. Use electrical heaters 

B. Use electrical coolers if required 

4. Assume SSME card for pricing. 

CONTROLLER dRCUIT CARD DIVISIONS 

INPUT PROCESSING CARDS 

IE1/IE2/IE3 8 temperature channels (programmable) 

8 pressure sensor channels 
8 self test inputs 

IE4 6 vibration processor channels 

IE5 8 speed/flow measurement units 

CONTROL PROCESSOR CARDS 

Vehicle interfaces 
Control 

Mass memory (Maintenance monitoring) 

OUTPUT PROCESSING CARDS 
OE1 Position feedback and EMA command drivers 

OE2/OE3 4 solenoid and 2 igniter drivers 


CPI 

CP2 

CP3 
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POWER SUPPLY CARDS 


PS1 

PS2 

PS3 

PS4 


Ml 


Similar to A2 of SSME Block II PS (Regulator) 
Similar to A4 of SSME Block II PS (Transformer) 
Similar to A4 of SSME Block II PS (Power) 

Voltage monitor and Thermal control (1/2 VM1 card in 
SSME Block II) 

MODEL 

Processing card for analytical redundancy model 


GENERAL OTV CONTROLLER DESIGN TASKS 


1. Requirements Definition 


A. Write a hardware specification 

B. Write a software specification 

2. System Design 


A. Set architecture 

B. Functional allocation 

C. Implementation approach 

1. Select logic family, self checking microprocessors, data 
busses 

2. Memory study (nonvolitale memory) 

D. Electrical Design 

E. Mechanical Design 

1. Thermal 

2. Packaging 

3. Brassboard (2) Use prototype cards 


4 . Prototype 


5. Qualification Unit - perform testing in simulated flight environment 
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6. Software Development 

A. Design IE1,2,3,4,5,CP1,2,3,0E1,2,3,M1 

B. Test 


CIRCUIT CARD DESCRIPTIONS AND DESIGN TASKS 
INPUT ELECTRONICS 

IE1/IE2/IE3 - Temperature/pressure card - Has temperature and pressure interface circuits with 

A/D, microcontroller, analog multiplexer, and the bus interface electronics. The interface circuits 
include hybrid designs. 

ffi4 Vibration processor card - Has accelerometer input interface circuits, 

tracking filters, microcontroller and bus interface circuits. 

Speed/flow card - Has the speed/flow interface circuits, time measurement 
circuits, and bus interface electronics. Time measurement units may be microcontroller based. 


CONTROL ELECTRONICS 

CP1 Vehicle interface card - Has 3 serial to parallel interfaces for redundant 

communication between the vehicle and control processor. 

CP2 Control processor card - Has the main self-checking control processor 

including program memory and internal bus electronics. 


CP3 


Mass memory card - Has the volatile memory - that is sized to record all 
measurements during engine operation for processing after engine cutoff. 


OUTPUT ELECTRONICS 


Position contro1 card * Has a microcontroller, memory, position measuring 
circuits, A/D converter for self test, analog interface drivers to EMA modules and bus electronics. 
The power driver circuits are to be in the EMA assembly. 
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OE2/OE3 Device driver card - Has microcontroller, memory, 4 smart solenoid 

drivers, igniter command circuit, igniter monitor circuit, and bus interface electronics. 


POWER SUPPLY ELECTRONICS 


PS 1/PS2/PS3 Power supply cards - Will convert input power to logic and analog voltages 
required to power controller. Does not power EMA's or regulate solenoid or igniter power. 

Voltage monitor and Thermal card - Monitors power supply performance, 
watchdog timers, and the thermal regulator for controlling heater/cooler. 

MODEL 


Model card - Contains processor, memory, bus interface, reads all 
measurements, and predicts performance in real time as an analytical redundancy channel. 


Design Tasks for all cards listed : 

1 . Design to specification 

2. Preliminary design - Review 

3. Breadboarding of critical circuits 

4. Card testing specification 

5. Prototype card testing 

6. Integration into brassboard 

7. Final design release 

8. Fabricate cards 
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TABLE I NOTES 


DWG CAT : 

I ^Numbers assigned and controlled by 

Advance Projects and Laser Engineerina 
Design functions. Hardware is used tc 
evaluate conceptual approaches and is not 
normally deliverable as Rocketdyne 
products. Drawings and parts per II thru 
IV may be used, as appropriate, and parts 
ordered per I. Chanqes to these parts, 
inspection and squawk dispositions, and 
drawinq chanqes shall be per the 

requirements specified for II thru IV 
respectively unless reidentified per T. 
"Releasina EO's" will be prepared by the 
Design function to have drawing oriqinals 
microfilmed and retained in the 
Engineering Document Repository. 

II Drawinq numbers assiqned and affixed by 
Numbers Assignment. Hardware may h€ 
deliverable for customer experimentation. 
Drawinqs and parts per III and IV may be 
used, as appropriate, and parts ordered 
P er II- Chanqes to these parts, 
inspection and squawk dispositions, and 
drawing changes shall be per III and IV 
unless reidentified per II. 

III Drawinq numbers assiqned and affixed by 
Numbers Assignment. Only III and IV 
hardware may be used in the product. 
GSE/AGE will normally be ordered in this 
Category (Level 2) and are assiqned "RG" 
numbers per DFM 742-0001. 

IV Drawinq numbers assiqned and affixed by 
Numbers Assignment. Only IV drawinqs and 
hardware are used in the product. 
Supplier hardware shall be '’controlled" 
with Speci f icat ion Control Drawinqs and 
Source Control Drawinqs. 

V e VI Drawinq numbers assigned and affixed by 
Numbers Assignment. Hardware is used tc 
supDort test mq/eva luat ion of hardware 
for I thru IV projects and may be 
deliverable for like activities by the 
customer. Drawings and Parts II, III, 
and IV may be used as components. 
Changes to such parts. Inspection and 
squawk dispositions shall be per II, III, 
and IV as applicable. Excluded from V 
are tools, fixtures, and devices for 
which Manufacturing, Quality Assurance, 
or Facilities and Industrial Engineering 
are responsible. 

VII Drawinq numbers assiqned and affixed by 
Numbers Assignment. Drawings and 

hardware are not deliverable and are used 
by DCD functions to simulate an item for 
experimentation only leadinq to desigr 
solutions for III and IV. These drawinqs 


shall not be used to define and fabricate 
complete products or product components. 
Orlqinatinq Engineers are personally 
responsible for providing oriqinals tc 
Enqineerinq Release for recording, 
microfilming and retention in the 
Enqineerinq Document Fepository. 


NOTES : 

(a) Comercia 1/Supplier parts may be used by 
direct call-out for Category I, II, v, VI 
and VII projects. Specification Control 
Drawings and Source Control Drawings 
shall be used for III and IV projects 
unless specifically exempted by the 
contract and so stipulated in the 
Engineering Flan of Aciton (EPCA). 

® Redlining of prints requires the 
authorizing Engineer's signature and 
date. This is not recommended as a 
qeneral practice due to potential 
loss/misinterpretation of design solution 
definition. 
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Program or Project, Engineering "on-the- 
spot" changes to drawinqs and parts for 
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will he siqned by the Engineer and will 
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"ON-THE-SPOT CHANGE MADE TO (Enter 
the part number and serial number cr 
Manufacturing Work Order Number as 
applicable. ) " 


© 


The originating Engineer is personally 
responsible for providing EO oriqinals tc 
Engineering Pelease for release. Release 
action, distribution of copies, and 
attachment to drawings shall be the same 
as for other EO*s for the project. 

Squawks may be disposit ioned by assigned 
Engineers by sign-off on the work erder 
or receiving report and, when elected by 
the Enginee^/Pro ject Engineer, documented 
by EO per (V) . Requirements to document 
by EO or otTTer methods of dispositionirq 
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( J) P25-F-2 f s shall be forwarded to Date 
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flysheet requirements for the erder- 
When inspection requirements are net 

specified on the R25-R-2, Receiving QA 
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